Aplicar requestMatchers con roles

Curso de Java Spring Security: Autenticación y Seguridad Web

Introducción

Seguridad en aplicaciones web

¿Qué es Spring Security?

Configurar Spring Security

Usar la autenticación por defecto

Configuración de seguridad

Crear configuración inicial de seguridad

¿Cómo funciona el BasicAuthenticationFilter?

Deshabilitar protección CSRF

Crear configuración de CORS

Aplicar requestMatchers

Crear autenticación en memoria

Aplicar requestMatchers con roles

Autenticación con BD

Crear usuarios en la base de datos

Implementar la interface UserDetailsService

Asignar roles a usuario

Aplicar authorities a los usuarios

Controlar métodos con Method Security

Seguridad con JWT

Añadir JWT al proyecto

Crear JWT cuando un usuario inicie sesión

Crear servicio para validar un JWT

Crear filtro para verificar el JWT

Aplicar filtro en la configuración

Próximos pasos

Auditoria de usuarios en la base de datos

¿Quieres un Curso de Microservicios con Java Spring?

No tienes acceso a esta clase

¡Continúa aprendiendo! Únete y comienza a potenciar tu carrera

Si ya tienes una cuenta,

Recursos

Aportes 4

Preguntas 0

Ordenar por:

¿Quieres ver más aportes, preguntas y respuestas de la comunidad?

Brayan Estiben Rodallega Saavedra

hace un año

package com.platzi.pizza.web.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {

        http
                .csrf().disable()
                .cors()
                .and()
                .authorizeHttpRequests()
                .requestMatchers(HttpMethod.GET, "/api/pizzas/**").hasAnyRole("ADMIN", "CUSTOMER")
                .requestMatchers(HttpMethod.POST, "/api/pizzas/**").hasRole("ADMIN")
                .requestMatchers(HttpMethod.PUT).hasRole("ADMIN")
                .requestMatchers("/api/orders/**").hasRole("ADMIN")
                .anyRequest()
                .authenticated()
                .and()
                .httpBasic();

        return http.build();

    }

    @Bean
    public UserDetailsService memoryUsers() {

        UserDetails admin = User.builder()
                .username("admin")
                .password(passwordEncoder().encode("admin"))
                .roles("ADMIN")
                .build();

        UserDetails customer = User.builder()
                .username("customer")
                .password(passwordEncoder().encode("customer123"))
                .roles("CUSTOMER")
                .build();

        return new InMemoryUserDetailsManager(admin, customer);

    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

}

Brayan Estiven Sepúlveda Quintero

hace un año

Para quienes estan trabajando con versiones de Spring Security superior a la del curso y les aparecen varios metodos deprecados:@Configuration @EnableWebSecurity public class WebSecurityConfig { public static final String *ADMIN* = "ADMIN"; public static final String *CUSTOMER* = "CUSTOMER"; @Bean public SecurityFilterChain configure(HttpSecurity http, CorsConfig corsConfig) throws Exception { http .csrf(AbstractHttpConfigurer::disable) .cors(cors -> cors.configurationSource(corsConfig.corsConfigurationSource())) .authorizeHttpRequests(requests -> requests .requestMatchers(HttpMethod.*GET*, "/api/pizzas/\*\*").hasAnyRole(*ADMIN*, *CUSTOMER*) .requestMatchers(HttpMethod.*POST*, "/api/pizzas/\*\*").hasRole(*ADMIN*) .requestMatchers(HttpMethod.*PUT*).hasRole(*ADMIN*) .requestMatchers("/api/orders/\*\*").hasRole(*ADMIN*) .anyRequest() .authenticated()) .httpBasic(Customizer.*withDefaults*()); return http.build(); } @Bean public UserDetailsService memoryUsers() { UserDetails admin = User.*builder*() .username("admin") .password(passwordEncoder().encode("admin")) .roles(*ADMIN*) .build(); UserDetails customer = User.*builder*() .username("customer") .password(passwordEncoder().encode("customer123")) .roles(*CUSTOMER*) .build(); return new InMemoryUserDetailsManager(admin, customer); } @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } } ```java @Configuration @EnableWebSecurity public class WebSecurityConfig { public static final String ADMIN = "ADMIN"; public static final String CUSTOMER = "CUSTOMER"; @Bean public SecurityFilterChain configure(HttpSecurity http, CorsConfig corsConfig) throws Exception { http .csrf(AbstractHttpConfigurer::disable) .cors(cors -> cors.configurationSource(corsConfig.corsConfigurationSource())) .authorizeHttpRequests(requests -> requests .requestMatchers(HttpMethod.GET, "/api/pizzas/**").hasAnyRole(ADMIN, CUSTOMER) .requestMatchers(HttpMethod.POST, "/api/pizzas/**").hasRole(ADMIN) .requestMatchers(HttpMethod.PUT).hasRole(ADMIN) .requestMatchers("/api/orders/**").hasRole(ADMIN) .anyRequest() .authenticated()) .httpBasic(Customizer.withDefaults()); return http.build(); } @Bean public UserDetailsService memoryUsers() { UserDetails admin = User.builder() .username("admin") .password(passwordEncoder().encode("admin")) .roles(ADMIN) .build(); UserDetails customer = User.builder() .username("customer") .password(passwordEncoder().encode("customer123")) .roles(CUSTOMER) .build(); return new InMemoryUserDetailsManager(admin, customer); } @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } } ```

ANDRES ALFONSO MIRA MEJIA

hace un año

✅

Alexander Coronell

hace 3 meses

```java package com.platzi.pizzeria.web.config; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.http.HttpMethod; import org.springframework.security.config.Customizer; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.provisioning.InMemoryUserDetailsManager; import org.springframework.security.web.SecurityFilterChain; @Configuration @EnableWebSecurity public class SecurityConfig { @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http .csrf(AbstractHttpConfigurer::disable) .cors(Customizer.withDefaults()) .authorizeHttpRequests((authorize) -> authorize .requestMatchers(HttpMethod.GET, "/api/pizzas/**").hasAnyRole("ADMIN", "CUSTOMER") .requestMatchers(HttpMethod.POST, "/api/pizzas/**").hasRole("ADMIN") .requestMatchers(HttpMethod.PUT).hasRole("ADMIN") .requestMatchers("/api/orders/**").hasRole("ADMIN") .anyRequest() .authenticated() ) .httpBasic(Customizer.withDefaults()) ; return http.build(); } @Bean public InMemoryUserDetailsManager memoryUsers() { UserDetails admin = User.builder() .username("admin") .password(passwordEncoder().encode("admin")) .roles("ADMIN") .build(); UserDetails customer = User.builder() .username("customer") .password(passwordEncoder().encode("customer123")) .roles("CUSTOMER") .build(); return new InMemoryUserDetailsManager(admin, customer); } @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } } ```